8cbfa5df7f
13 changes to exploits/shellcodes HC10 HC.Server Service 10.14 - Remote Invalid Pointer Write Netperf 2.6.0 - Stack-Based Buffer Overflow Thunderbird ESR < 60.7.XXX - Type Confusion Thunderbird ESR < 60.7.XXX - 'icalmemorystrdupanddequote' Heap-Based Buffer Overflow Thunderbird ESR < 60.7.XXX - 'parser_get_next_char' Heap-Based Buffer Overflow Thunderbird ESR < 60.7.XXX - 'icalrecur_add_bydayrules' Stack-Based Buffer Overflow Exim 4.87 - 4.91 - Local Privilege Escalation Microsoft Windows - UAC Protection Bypass (Via Slui File Handler Hijack) (PowerShell) AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit) RedwoodHQ 2.5.5 - Authentication Bypass CleverDog Smart Camera DOG-2W / DOG-2W-V4 - Multiple Vulnerabilities Spring Security OAuth - Open Redirector Linux/x86 - Reposition + INC encoder with execve(/bin/sh) Shellcode (66 bytes)
27 lines
No EOL
1.5 KiB
Text
27 lines
No EOL
1.5 KiB
Text
1. Advisory Information
|
|
========================================
|
|
Title: Clever Dog Smart Camera
|
|
Vendor Homepage: http://www.cleverdog.com.cn/
|
|
Tested on Camera types : DOG-2W, DOG-2W-V4
|
|
Vulnerability: Hardware- Multiple Vulnerabilities
|
|
Date: 14/06/2019
|
|
Author: Alex Akinbi Twitter: @alexakinbi
|
|
|
|
1. Unauthenticated file disclosure:
|
|
========================================
|
|
An attacker on the local network has unauthenticated access to the internal SD card via HTTP service on port 8000. The HTTP web server on the camera allows an attacker to download video archive recorded and saved on the external memory card attached.
|
|
For example: http://192.168.1.81:8000/20190606
|
|
|
|
2. Telnet Backdoor using default credentials:
|
|
========================================
|
|
An attacker on the network can login remotely to the camera and gain root access. The device ships with hard-coded credentials, accessible from a telnet login prompt using credentials username: " root" and password: "12345678". These credentials work on all devices.
|
|
|
|
3. Login password sent over network unencrypted using Clever Dog App:
|
|
========================================
|
|
Using a packet sniffer, an attacker on the same network can capture data packets and view
|
|
captured user login password MD5 hash. A weak password can be cracked and used to login to the user account.
|
|
|
|
|
|
4. SOLUTION
|
|
========================================
|
|
Contact the vendor for further information regarding the proper mitigation of this vulnerability. |